A malware campaign injects malicious code into a build configuration file (vite.config.js) through forged merge commits, enabling code execution during npm run build without touching node_modules or package.json.

Immediate mitigation involves disconnecting affected machines, terminating the malicious process, revoking compromised credentials (SSH keys, tokens, cloud keys, npm tokens), and restoring branches to legitimate commits; enforce repository protections to block force-pushes and require signed commits.

The attack is associated with named campaigns and variants such as ChainVeil, ViteVenom, PolinRider, and a Tailwind.config.js variant; EtherHiding uses Ethereum and other blockchains as C2 channels.

Extended guidance notes a Tailwind.config.js and .gitignore variant as of late September 2026, adding checks for markers and environment disclosures, and mentions a free read-only tool for detecting vites-config-malware.

Propagation can affect multiple branches including production and staging, and attackers can exfiltrate keys, tokens, and other secrets stored on the victim machine by leveraging compromised credentials.

Prevention emphasizes isolated environments per project, branch protections, read-only deploy keys, strong SSH key passphrases, and treating npm run build as potentially untrusted while continuously auditing credentials access.

Detection indicators include a running node process with specific in-memory strings, unusual outbound connections to the C2, and poisoned build config snippets like _$jsoToArr, plus signs of unsigned or suspicious merge commits altering vite.config.js.

The core takeaway is that manipulating a trusted build config is the attack vector; the only reliable defense is preventing force-pushes, credential compromise, enforcing commit signing, and robust repository protections.

Attack flow involves using a compromised developer credential to force-push poisoned commits across branches, replacing legitimate builds with a payload that executes during build.

Stage-by-stage mechanics show the malware appending obfuscated code to the build config, hiding payloads via whitespace, leveraging ES module quirks for require, obtaining a C2 address from a public blockchain (EtherHiding), and executing code from the C2 via eval.